security

One command hides four layers of software and a set of standards that made them interchangeable. This lesson takes the stack apart, then asks the question the whole path has been building toward: given a shared kernel, how much is container isolation actually worth, and what has to be added before it is a security boundary.

QKD has an unconditional security proof and almost no deployment. This lesson covers the authentication bootstrap it cannot solve, distance limits and the trusted node compromise, attacks on real hardware that the proof does not cover, why NSA and NCSC recommend against it, and where quantum genuinely delivers.

The other direction of the problem. Employees using AI tools create exposure through data leaving the organisation, prompt injection turning an assistant against its user, malicious extensions, and code suggestions nobody verified. This lesson covers what to worry about and what is overstated.

If recognition no longer establishes identity, verification has to move to the channel. This lesson builds the practice: out-of-band confirmation, which requests need it, designing protocols people will actually follow under pressure, the household version, and what to do in the first hour after something goes wrong.

Security awareness training taught people to spot bad grammar, odd domains and generic greetings. Those signals are gone. This lesson covers what generative tools changed about attacks, what they did not change, and why detection-based defence was always the weaker half.

Assistants sit where authority, access and urgency meet, which is exactly what impersonation fraud exploits. This lesson covers why the role is targeted, what changed when voice and video became cheap to fake, and the verification habits that hold up when a convincing executive is asking you to move quickly.

Self-hosting is a permanent operational responsibility rather than a project. This lesson covers the security surface a local model creates, model upgrades and why they are harder than they look, capacity and cost control, what to monitor, and the honest signals that the deployment should be retired.

No single wall stops a determined attacker, so real security is built in layers on one assumption: a breach will eventually happen. Learn the practical defender's playbook, least privilege, network segmentation and zero trust, patching, encryption done right, and the detection and incident response that limit the damage when prevention fails, each mapped to the attack stages it defeats.

Most technical breaches trace to one root cause: an application trusting input it should not. Walk through the real vulnerabilities with concrete code, SQL injection, cross-site scripting, broken access control, and vulnerable dependencies, seeing exactly how each is exploited and, just as concretely, how each is fixed. Practical, example-driven, and defense-focused throughout.

Most breaches do not start with clever code; they start with a person. Learn how phishing actually works by dissecting a real example, how passwords get stolen through breaches, credential stuffing, and spraying, why multi-factor authentication helps and how attackers bypass it, and the practical habits, unique passwords, password managers, phishing-resistant MFA, that defend the human layer.

Real attacks are not a single dramatic moment; they are a patient, multi-stage process. Learn to think like an attacker and follow the chain from reconnaissance to initial access, privilege escalation, lateral movement, and the final objective. Understanding this sequence is the foundation of both breaking in and defending, because every stage is also a chance to stop the attack.

Why LLM apps are uniquely vulnerable to attacks delivered as plain text, the difference between direct and indirect injection, and the defences that actually help (plus the ones that don't).

Explore the core concepts of OAuth 2.0, its various grant types, and how it enables secure, delegated access without sharing credentials. Understand the roles and the step-by-step authorization process.